@centient/secrets 0.9.0 → 0.11.0

package/dist/sinks/otel.js

@@ -0,0 +1,155 @@
+import { SpanKind, SpanStatusCode, TraceFlags, trace, } from "@opentelemetry/api";
+import { asError, defaultAuditSinkErrorHandler, } from "./types.js";
+const TRACER_NAME = "@centient/secrets";
+const SPAN_NAME = "centient.secrets.credential";
+export class OtelAuditSinkDegradedError extends Error {
+    code = "OTEL_AUDIT_SINK_DEGRADED";
+    constructor(reason) {
+        super(reason === "not-recording"
+            ? "OpenTelemetry audit span is not recording; configure an audit tracer provider"
+            : "OpenTelemetry audit span is not sampled; configure an always-on audit sampler");
+        this.name = "OtelAuditSinkDegradedError";
+    }
+}
+/** Flatten one OCSF JSON record into primitive span attributes. */
+export function credentialAuditSpanAttributes(event) {
+    const attestation = event.attestation_list?.[0];
+    const previousHash = attestation?.prev_event?.fingerprint.value;
+    const durationMs = event.unmapped["centient.secrets.operation.duration_ms"];
+    return {
+        "ocsf.category_uid": event.category_uid,
+        "ocsf.class_uid": event.class_uid,
+        "ocsf.type_uid": event.type_uid,
+        "ocsf.activity_id": event.activity_id,
+        "ocsf.activity_name": event.activity_name,
+        "ocsf.action_id": event.action_id,
+        "ocsf.status_id": event.status_id,
+        "ocsf.severity_id": event.severity_id,
+        "ocsf.time": event.time,
+        "ocsf.metadata.version": event.metadata.version,
+        "ocsf.metadata.uid": event.metadata.uid,
+        "ocsf.actor.user.uid": event.actor.user.uid,
+        "ocsf.entity.name": event.entity.name,
+        "ocsf.entity.type": event.entity.type,
+        "ocsf.entity.type_id": event.entity.type_id,
+        "centient.secrets.credential.vault.name": event.entity.data.vault_name,
+        "centient.secrets.operation.duration_ms": durationMs,
+        "centient.secrets.event_type": event.unmapped["centient.secrets.event_type"],
+        // ADR-002's original attribute spellings are retained as projection
+        // aliases. They are not fields in released OCSF 1.9 JSON.
+        activity_id: event.activity_id,
+        "actor.user": event.actor.user.uid,
+        "credential.name": event.entity.name,
+        "credential.vault.name": event.entity.data.vault_name,
+        status_id: event.status_id,
+        time: event.time,
+        duration: durationMs,
+        ...(event.status_detail !== undefined
+            ? { "ocsf.status_detail": event.status_detail }
+            : {}),
+        ...(event.metadata.sequence !== undefined
+            ? {
+                "ocsf.metadata.sequence": event.metadata.sequence,
+                sequence_number: event.metadata.sequence,
+            }
+            : {}),
+        ...(attestation !== undefined
+            ? {
+                "ocsf.attestation.chain_uid": attestation.chain_uid,
+                "ocsf.attestation.fingerprint": attestation.fingerprint.value,
+                event_hash: attestation.fingerprint.value,
+            }
+            : {}),
+        ...(previousHash !== undefined
+            ? {
+                "ocsf.attestation.prev_event.fingerprint": previousHash,
+                previous_hash: previousHash,
+            }
+            : {}),
+        ...(event.unmapped["centient.audit_chain.key_id"] !== undefined
+            ? {
+                "centient.audit_chain.key_id": event.unmapped["centient.audit_chain.key_id"],
+            }
+            : {}),
+    };
+}
+/**
+ * Emit one completed credential operation as a retroactive OTel span. The
+ * application owns SDK/exporter configuration; this package depends only on
+ * the OTel API, as required for reusable instrumentation libraries.
+ */
+export function otelAuditSink(options = {}) {
+    const tracer = options.tracer ?? trace.getTracer(TRACER_NAME);
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    let degraded;
+    let failures = 0;
+    let degradationReported = false;
+    const report = (error, once = false) => {
+        degraded = error;
+        failures += 1;
+        if (once && degradationReported)
+            return;
+        if (once)
+            degradationReported = true;
+        try {
+            onError(error);
+        }
+        catch (handlerError) {
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    };
+    const sink = ((event) => {
+        let span;
+        try {
+            span = tracer.startSpan(SPAN_NAME, {
+                kind: SpanKind.INTERNAL,
+                startTime: event.time,
+                attributes: credentialAuditSpanAttributes(event),
+            });
+        }
+        catch (error) {
+            const normalized = asError(error);
+            report(normalized);
+            throw normalized;
+        }
+        let operationError;
+        try {
+            if (!span.isRecording()) {
+                report(new OtelAuditSinkDegradedError("not-recording"), true);
+            }
+            else if ((span.spanContext().traceFlags & TraceFlags.SAMPLED) === 0) {
+                report(new OtelAuditSinkDegradedError("not-sampled"), true);
+            }
+            span.setStatus({
+                code: event.status_id === 1 ? SpanStatusCode.OK : SpanStatusCode.ERROR,
+                ...(event.status_detail !== undefined ? { message: event.status_detail } : {}),
+            });
+        }
+        catch (error) {
+            operationError = asError(error);
+            report(operationError);
+        }
+        try {
+            // A started span must be ended even when its recording/status methods
+            // throw through an injected tracer seam.
+            span.end(event.time + event.unmapped["centient.secrets.operation.duration_ms"]);
+        }
+        catch (error) {
+            const endError = asError(error);
+            report(endError);
+            operationError = operationError === undefined
+                ? endError
+                : new AggregateError([operationError, endError], "OpenTelemetry audit span processing and end both failed");
+        }
+        if (operationError !== undefined)
+            throw operationError;
+    });
+    sink.health = () => ({
+        status: degraded === undefined ? "healthy" : "degraded",
+        pending: 0,
+        failures,
+        ...(degraded !== undefined ? { lastError: degraded.message } : {}),
+    });
+    return sink;
+}
+//# sourceMappingURL=otel.js.map

package/dist/sinks/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../src/sinks/otel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,cAAc,EACd,UAAU,EACV,KAAK,GAGN,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,OAAO,EACP,4BAA4B,GAI7B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,0BAAmC,CAAC;IAEpD,YAAY,MAAuC;QACjD,KAAK,CACH,MAAM,KAAK,eAAe;YACxB,CAAC,CAAC,+EAA+E;YACjF,CAAC,CAAC,+EAA+E,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AASD,mEAAmE;AACnE,MAAM,UAAU,6BAA6B,CAC3C,KAA2B;IAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;IAE5E,OAAO;QACL,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,oBAAoB,EAAE,KAAK,CAAC,aAAa;QACzC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/C,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;QAC3C,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACrC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACrC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC3C,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;QACtE,wCAAwC,EAAE,UAAU;QACpD,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5E,oEAAoE;QACpE,0DAA0D;QAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;QAClC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACpC,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;YACvC,CAAC,CAAC;gBACE,wBAAwB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACjD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;aACzC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC;gBACE,4BAA4B,EAAE,WAAW,CAAC,SAAS;gBACnD,8BAA8B,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK;gBAC7D,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC;gBACE,yCAAyC,EAAE,YAAY;gBACvD,aAAa,EAAE,YAAY;aAC5B;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,KAAK,SAAS;YAC7D,CAAC,CAAC;gBACE,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;aAC7E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,IAAI,QAA2B,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,MAAM,MAAM,GAAG,CAAC,KAAY,EAAE,IAAI,GAAG,KAAK,EAAQ,EAAE;QAClD,QAAQ,GAAG,KAAK,CAAC;QACjB,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,IAAI,IAAI,mBAAmB;YAAE,OAAO;QACxC,IAAI,IAAI;YAAE,mBAAmB,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,KAA2B,EAAQ,EAAE;QAClD,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE;gBACjC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnB,MAAM,UAAU,CAAC;QACnB,CAAC;QAED,IAAI,cAAiC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,0BAA0B,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,0BAA0B,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK;gBACtE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,sEAAsE;YACtE,yCAAyC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjB,cAAc,GAAG,cAAc,KAAK,SAAS;gBAC3C,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,cAAc,CAChB,CAAC,cAAc,EAAE,QAAQ,CAAC,EAC1B,yDAAyD,CAC1D,CAAC;QACR,CAAC;QACD,IAAI,cAAc,KAAK,SAAS;YAAE,MAAM,cAAc,CAAC;IACzD,CAAC,CAAc,CAAC;IAEhB,IAAI,CAAC,MAAM,GAAG,GAAoB,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACvD,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sinks/queue.d.ts

@@ -0,0 +1,12 @@
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+import { type AuditSink, type AuditSinkErrorHandler } from "./types.js";
+export interface QueuedAuditSinkOptions {
+    readonly name: string;
+    readonly write: (event: CredentialAuditEvent) => void | Promise<void>;
+    readonly close?: () => void | Promise<void>;
+    readonly maxPending?: number;
+    readonly onError?: AuditSinkErrorHandler;
+}
+/** Internal serialized queue shared by the JSONL and syslog transports. */
+export declare function createQueuedAuditSink(options: QueuedAuditSinkOptions): AuditSink;
+//# sourceMappingURL=queue.d.ts.map

package/dist/sinks/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/sinks/queue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAID,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,SAAS,CAgGhF"}

package/dist/sinks/queue.js

@@ -0,0 +1,89 @@
+import { asError, AuditSinkOverflowError, defaultAuditSinkErrorHandler, } from "./types.js";
+const DEFAULT_MAX_PENDING = 1_000;
+/** Internal serialized queue shared by the JSONL and syslog transports. */
+export function createQueuedAuditSink(options) {
+    const maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
+    if (!Number.isSafeInteger(maxPending) || maxPending < 1) {
+        throw new RangeError("maxPending must be a positive safe integer");
+    }
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    let tail = Promise.resolve();
+    let pending = 0;
+    let failures = 0;
+    let lastError;
+    let closed = false;
+    let closePromise;
+    const recordFailure = (error) => {
+        const normalized = asError(error);
+        failures += 1;
+        lastError = normalized;
+        try {
+            onError(normalized);
+        }
+        catch (handlerError) {
+            // An error reporter must not turn a handled queue rejection into an
+            // unhandled rejection. The fallback is deliberately value-free.
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    };
+    const sink = ((event) => {
+        if (closed) {
+            throw new Error(`${options.name} audit sink is closed`);
+        }
+        if (pending >= maxPending) {
+            const error = new AuditSinkOverflowError(options.name, maxPending);
+            recordFailure(error);
+            throw error;
+        }
+        pending += 1;
+        const writeResult = tail.then(() => options.write(event));
+        tail = writeResult.then(() => {
+            pending -= 1;
+        }, (error) => {
+            pending -= 1;
+            recordFailure(error);
+        });
+    });
+    sink.flush = async () => {
+        await tail;
+        if (failures > 0) {
+            throw new AggregateError(lastError === undefined ? [] : [lastError], `${options.name} audit sink failed to write ${failures} record(s)`);
+        }
+    };
+    sink.close = () => {
+        if (closePromise !== undefined)
+            return closePromise;
+        closed = true;
+        closePromise = (async () => {
+            const closeErrors = [];
+            try {
+                await sink.flush?.();
+            }
+            catch (error) {
+                closeErrors.push(asError(error));
+            }
+            try {
+                await options.close?.();
+            }
+            catch (error) {
+                const normalized = asError(error);
+                recordFailure(normalized);
+                closeErrors.push(normalized);
+            }
+            if (closeErrors.length === 1)
+                throw closeErrors[0];
+            if (closeErrors.length > 1) {
+                throw new AggregateError(closeErrors, `${options.name} audit sink drain and transport close both failed`);
+            }
+        })();
+        return closePromise;
+    };
+    sink.health = () => ({
+        status: failures === 0 ? "healthy" : "degraded",
+        pending,
+        failures,
+        ...(lastError !== undefined ? { lastError: lastError.message } : {}),
+    });
+    return sink;
+}
+//# sourceMappingURL=queue.js.map

package/dist/sinks/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../src/sinks/queue.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,4BAA4B,GAI7B,MAAM,YAAY,CAAC;AAUpB,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,IAAI,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAA4B,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,YAAuC,CAAC;IAE5C,MAAM,aAAa,GAAG,CAAC,KAAc,EAAQ,EAAE;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC;QACd,SAAS,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,oEAAoE;YACpE,gEAAgE;YAChE,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,KAA2B,EAAQ,EAAE;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACnE,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,GAAG,WAAW,CAAC,IAAI,CACrB,GAAG,EAAE;YACH,OAAO,IAAI,CAAC,CAAC;QACf,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,OAAO,IAAI,CAAC,CAAC;YACb,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CACF,CAAC;IACJ,CAAC,CAAc,CAAC;IAEhB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,IAAI,CAAC;QACX,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,cAAc,CACtB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAC1C,GAAG,OAAO,CAAC,IAAI,+BAA+B,QAAQ,YAAY,CACnE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,GAAG,GAAkB,EAAE;QAC/B,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;QACpD,MAAM,GAAG,IAAI,CAAC;QACd,YAAY,GAAG,CAAC,KAAK,IAAmB,EAAE;YACxC,MAAM,WAAW,GAAY,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAClC,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,GAAG,OAAO,CAAC,IAAI,mDAAmD,CACnE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,IAAI,CAAC,MAAM,GAAG,GAAoB,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAC/C,OAAO;QACP,QAAQ;QACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sinks/syslog.d.ts

@@ -0,0 +1,17 @@
+import { type AuditSink, type AuditSinkErrorHandler } from "./types.js";
+export type SyslogAuditSender = (message: string) => void | Promise<void>;
+export interface SyslogAuditSinkOptions {
+    readonly host?: string;
+    readonly port?: number;
+    /** RFC 5424 facility number. Defaults to 10 (`authpriv`). */
+    readonly facility?: number;
+    readonly hostname?: string;
+    readonly appName?: string;
+    readonly maxPending?: number;
+    readonly onError?: AuditSinkErrorHandler;
+    /** Injectable transport seam. When omitted, UDP is used. */
+    readonly sender?: SyslogAuditSender;
+}
+/** Create an RFC 5424 syslog sink, using UDP unless a sender is injected. */
+export declare function syslogAuditSink(options?: SyslogAuditSinkOptions): AuditSink;
+//# sourceMappingURL=syslog.d.ts.map

package/dist/sinks/syslog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syslog.d.ts","sourceRoot":"","sources":["../../src/sinks/syslog.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AA2ED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,SAAS,CA8B/E"}

package/dist/sinks/syslog.js

@@ -0,0 +1,103 @@
+import { createSocket } from "node:dgram";
+import { hostname as getHostname } from "node:os";
+import { createQueuedAuditSink } from "./queue.js";
+import { asError, defaultAuditSinkErrorHandler, } from "./types.js";
+function headerToken(value, fallback) {
+    const sanitized = value.replace(/[^\x21-\x7e]/g, "_").slice(0, 48);
+    return sanitized.length === 0 ? fallback : sanitized;
+}
+function syslogMessage(event, options) {
+    // RFC 5424: informational for a successful operation, warning otherwise.
+    const severity = event.status_id === 1 ? 6 : 4;
+    const priority = options.facility * 8 + severity;
+    const timestamp = new Date(event.time).toISOString();
+    const host = headerToken(options.hostname, "-");
+    const appName = headerToken(options.appName, "centient-secrets");
+    return `<${priority}>1 ${timestamp} ${host} ${appName} ${process.pid} OCSF3004 - ${JSON.stringify(event)}`;
+}
+function createUdpSender(host, port, onError) {
+    const socket = createSocket(host.includes(":") ? "udp6" : "udp4");
+    let sendInFlight = false;
+    let started = false;
+    socket.unref();
+    // Keep socket-level failures observable even if they occur outside a send
+    // callback. A per-send listener below also rejects the queued write.
+    socket.on("error", (error) => {
+        if (sendInFlight)
+            return;
+        try {
+            onError(error);
+        }
+        catch (handlerError) {
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    });
+    return {
+        send(message) {
+            return new Promise((resolve, reject) => {
+                sendInFlight = true;
+                const onSocketError = (error) => {
+                    socket.off("error", onSocketError);
+                    sendInFlight = false;
+                    reject(error);
+                };
+                socket.once("error", onSocketError);
+                try {
+                    started = true;
+                    socket.send(message, port, host, (error) => {
+                        socket.off("error", onSocketError);
+                        sendInFlight = false;
+                        if (error)
+                            reject(error);
+                        else
+                            resolve();
+                    });
+                }
+                catch (error) {
+                    socket.off("error", onSocketError);
+                    sendInFlight = false;
+                    started = false;
+                    reject(error);
+                }
+            });
+        },
+        close() {
+            if (!started)
+                return Promise.resolve();
+            return new Promise((resolve) => {
+                socket.close(() => resolve());
+            });
+        },
+    };
+}
+/** Create an RFC 5424 syslog sink, using UDP unless a sender is injected. */
+export function syslogAuditSink(options = {}) {
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 514;
+    const facility = options.facility ?? 10;
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new RangeError("syslog port must be an integer from 1 through 65535");
+    }
+    if (!Number.isInteger(facility) || facility < 0 || facility > 23) {
+        throw new RangeError("syslog facility must be an integer from 0 through 23");
+    }
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    const udp = options.sender === undefined
+        ? createUdpSender(host, port, onError)
+        : undefined;
+    const sender = options.sender ?? udp.send;
+    return createQueuedAuditSink({
+        name: "syslog",
+        ...(options.maxPending !== undefined ? { maxPending: options.maxPending } : {}),
+        onError,
+        write(event) {
+            return sender(syslogMessage(event, {
+                facility,
+                hostname: options.hostname ?? getHostname(),
+                appName: options.appName ?? "centient-secrets",
+            }));
+        },
+        ...(udp !== undefined ? { close: udp.close } : {}),
+    });
+}
+//# sourceMappingURL=syslog.js.map

package/dist/sinks/syslog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syslog.js","sourceRoot":"","sources":["../../src/sinks/syslog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAGlD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,OAAO,EACP,4BAA4B,GAG7B,MAAM,YAAY,CAAC;AAiBpB,SAAS,WAAW,CAAC,KAAa,EAAE,QAAgB;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CACpB,KAA2B,EAC3B,OAAoF;IAEpF,yEAAyE;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACjE,OAAO,IAAI,QAAQ,MAAM,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAY,EACZ,OAA8B;IAE9B,MAAM,MAAM,GAAW,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,YAAY;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,CAAC,OAAO;YACV,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,aAAa,GAAG,CAAC,KAAY,EAAQ,EAAE;oBAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBACnC,YAAY,GAAG,KAAK,CAAC;oBACrB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;wBACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBACnC,YAAY,GAAG,KAAK,CAAC;wBACrB,IAAI,KAAK;4BAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;4BACpB,OAAO,EAAE,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBACnC,YAAY,GAAG,KAAK,CAAC;oBACrB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAI,CAAC,IAAI,CAAC;IAE3C,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO;QACP,KAAK,CAAC,KAAK;YACT,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;gBACjC,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB;aAC/C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;AACL,CAAC"}

package/dist/sinks/types.d.ts

@@ -0,0 +1,27 @@
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+export interface AuditSinkHealth {
+    readonly status: "healthy" | "degraded";
+    readonly pending: number;
+    readonly failures: number;
+    readonly lastError?: string;
+}
+/**
+ * Synchronous policy boundary. Buffered sinks enqueue before returning and
+ * expose `flush()` so delivery-sensitive callers can observe async failure.
+ */
+export interface AuditSink {
+    (event: CredentialAuditEvent): void;
+    flush?(): Promise<void>;
+    close?(): Promise<void>;
+    health?(): AuditSinkHealth;
+}
+export type AuditSinkErrorHandler = (error: Error) => void;
+export declare class AuditSinkOverflowError extends Error {
+    readonly sink: string;
+    readonly maxPending: number;
+    readonly code: "AUDIT_SINK_OVERFLOW";
+    constructor(sink: string, maxPending: number);
+}
+export declare function asError(error: unknown): Error;
+export declare function defaultAuditSinkErrorHandler(error: Error): void;
+//# sourceMappingURL=types.d.ts.map

package/dist/sinks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sinks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,eAAe,CAAC;CAC5B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;AAE3D,qBAAa,sBAAuB,SAAQ,KAAK;IAI7C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAJ7B,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBAGpC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM;CAK9B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAE7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE/D"}

package/dist/sinks/types.js

@@ -0,0 +1,18 @@
+export class AuditSinkOverflowError extends Error {
+    sink;
+    maxPending;
+    code = "AUDIT_SINK_OVERFLOW";
+    constructor(sink, maxPending) {
+        super(`${sink} audit sink queue reached its ${maxPending}-record limit`);
+        this.sink = sink;
+        this.maxPending = maxPending;
+        this.name = "AuditSinkOverflowError";
+    }
+}
+export function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+export function defaultAuditSinkErrorHandler(error) {
+    process.stderr.write(`[secrets] audit sink failure: ${error.message}\n`);
+}
+//# sourceMappingURL=types.js.map

package/dist/sinks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sinks/types.ts"],"names":[],"mappings":"AAsBA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAIpC;IACA;IAJF,IAAI,GAAG,qBAA8B,CAAC;IAE/C,YACW,IAAY,EACZ,UAAkB;QAE3B,KAAK,CAAC,GAAG,IAAI,iCAAiC,UAAU,eAAe,CAAC,CAAC;QAHhE,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;QAG3B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAY;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC3E,CAAC"}

package/dist/vault/policy.d.ts

@@ -1,42 +1,50 @@
 /**
  * SecretsPolicy — Middleware layer for credential operations.
  *
- * Policies are cross-cutting concerns (audit, rate limiting, access
- * control, attestation) applied to every credential operation via
- * `setSecretsPolicies([...])`. In 0.5.0 only the audit policy is
- * shipped; the API shape is designed to grow into the full policy
- * stack described in ADR-002.
+ * Policies are cross-cutting concerns (audit, rate limiting, access control,
+ * attestation) applied to every credential operation. Explicit clients own an
+ * isolated stack supplied to `createSecretsClient`; `setSecretsPolicies`
+ * remains as the deprecated configuration path for the module-level shims and
+ * SessionVault. The API shape is designed for the full stack in ADR-002.
  *
  * Execution model:
  *   1. `before` hooks run top-to-bottom. If one throws, the operation
  *      is aborted and the error propagates to the caller — but the
- *      `after` hooks of already-entered policies (those whose `before`
- *      hook already completed) still fire with a `*_rejected` event, so
+ *      rejecting policy and already-entered policies still fire their
+ *      `after` hooks with a `*_rejected` event, so
  *      a policy-denied operation is audited rather than vanishing
- *      (ADR-002 §1.0.0). The rejecting policy's own `after` hook does
- *      not fire — its `before` hook did not complete.
+ *      (issue #98). Policies not yet reached do not fire.
  *   2. The backend operation executes.
  *   3. `after` hooks run bottom-to-top with a structured event
  *      describing the outcome. Exceptions in `after` hooks are
  *      swallowed with a one-time stderr warning — audit infrastructure
  *      failures must never break credential operations.
  */
-import type { VaultType } from "./types.js";
 export type SecretsEventType = "credential_read" | "credential_read_missing" | "credential_read_failed" | "credential_read_rejected" | "credential_written" | "credential_write_failed" | "credential_write_rejected" | "credential_deleted" | "credential_delete_failed" | "credential_delete_rejected" | "credential_enumerated" | "credential_enumerate_failed" | "credential_enumerate_rejected";
 export interface SecretsEvent {
-    type: SecretsEventType;
-    timestamp: string;
-    backend: VaultType;
-    key?: string;
-    keyCount?: number;
-    prefix?: string;
-    error?: string;
-    durationMs: number;
+    readonly type: SecretsEventType;
+    readonly timestamp: string;
+    readonly backend: string;
+    /** Full value-free operation descriptor supplied to policy hooks. */
+    readonly operation: SecretsOperation;
+    readonly key?: string;
+    readonly keyCount?: number;
+    readonly prefix?: string;
+    readonly error?: string;
+    readonly durationMs: number;
+}
+export interface SecretsCaller {
+    readonly id: string;
+    readonly kind?: string;
+}
+export interface SecretsOperationContext {
+    readonly caller?: SecretsCaller;
 }
 export interface SecretsOperation {
-    type: "read" | "write" | "delete" | "enumerate";
-    key?: string;
-    prefix?: string;
+    readonly type: "read" | "write" | "delete" | "enumerate";
+    readonly key?: string;
+    readonly prefix?: string;
+    readonly caller?: SecretsCaller;
 }
 /**
  * The audit event type emitted when a `before` hook rejects an
@@ -46,6 +54,12 @@ export interface SecretsOperation {
 export declare function rejectedEventType(op: SecretsOperation): SecretsEventType;
 export interface SecretsPolicy {
     readonly name: string;
+    /**
+     * Set by policies whose contract includes observing every policy denial.
+     * Such a policy must appear before every `before` hook, because a preceding
+     * hook can reject before the observer is entered.
+     */
+    readonly observesPolicyRejections?: true;
     /** `before` hooks may be async; they are awaited before the operation runs. */
     before?(op: SecretsOperation): void | Promise<void>;
     /**
@@ -59,23 +73,39 @@ export interface SecretsPolicy {
      */
     after?(event: SecretsEvent): void;
 }
+export type PolicyStackFrame = readonly SecretsPolicy[];
+export interface PolicyRunner {
+    runBefore(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<PolicyStackFrame>;
+    runAfter(event: SecretsEvent, frame?: PolicyStackFrame): void;
+    getPolicies(): readonly SecretsPolicy[];
+    replacePolicies(policies: readonly SecretsPolicy[]): void;
+}
+/**
+ * Build an isolated policy runner. Its input is snapshotted immediately, and
+ * every operation captures the current immutable frame so replacement cannot
+ * splice two different stacks across an await boundary.
+ */
+export declare function createPolicyRunner(initialPolicies?: readonly SecretsPolicy[]): PolicyRunner;
+/** Global runner retained only for legacy module APIs and SessionVault. */
+export declare const defaultPolicyRunner: PolicyRunner;
+/**
+ * @deprecated Configure policies on an isolated client created with
+ * `createSecretsClient`. This setter remains for module-level shims and
+ * SessionVault compatibility through the 1.x deprecation window.
+ */
 export declare function setSecretsPolicies(policies: SecretsPolicy[]): void;
+/** @deprecated Inspect the policy list owned by the legacy default client. */
 export declare function getActivePolicies(): readonly SecretsPolicy[];
 /**
  * Run `before` hooks top-to-bottom. If a hook throws, the operation is
- * rejected: the `after` hooks of the already-entered policies (indices
- * `0..i-1`, bottom-to-top) fire with the event built by
+ * rejected: the rejecting policy and already-entered policies (indices
+ * `0..i`, bottom-to-top) fire `after` with the event built by
  * `makeRejectionEvent` so the denied operation is still audited, then the
- * original error is re-thrown to abort the operation. The rejecting
- * policy's own `after` hook is intentionally skipped — its `before` hook
- * did not complete, so the policy was not fully entered. See ADR-002
- * §1.0.0.
+ * original error is re-thrown to abort the operation. This follows issue
+ * #98's acceptance contract; policies after the rejector are never entered.
  */
-export declare function runBeforeHooks(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<void>;
-export declare function runAfterHooks(event: SecretsEvent): void;
-export interface AuditTrailOptions {
-    sink: (event: SecretsEvent) => void;
-    includeReads?: boolean;
-}
-export declare function auditTrail(opts: AuditTrailOptions): SecretsPolicy;
+export declare function runBeforeHooks(op: SecretsOperation, makeRejectionEvent: (error: string) => SecretsEvent): Promise<PolicyStackFrame>;
+export declare function runAfterHooks(event: SecretsEvent, frame?: PolicyStackFrame): void;
+export { auditTrail } from "../policies/audit-trail.js";
+export type { AuditEventChain, AuditTrailOptions, } from "../policies/audit-trail.js";
 //# sourceMappingURL=policy.d.ts.map

package/dist/vault/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,4BAA4B,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiBxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AASD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAGlE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEvD;AAkCD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAejE"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/vault/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,4BAA4B,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiBxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;IACzC,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAMD,MAAM,MAAM,gBAAgB,GAAG,SAAS,aAAa,EAAE,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,SAAS,CACP,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9D,WAAW,IAAI,SAAS,aAAa,EAAE,CAAC;IACxC,eAAe,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAC;CAC3D;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,GAAE,SAAS,aAAa,EAAO,GAC7C,YAAY,CAkDd;AAED,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,cAAuB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,gBAAgB,EACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,GAClD,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,gBAAgB,GACvB,IAAI,CAEN;AAGD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}